admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
8,347 Commits 697 Branches 195 Tags
94de7c8d57553ed698e489857713153cc386170e
Commit Graph

8347 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
dependabot[bot] b3f451c3c1 Bump botocore from 1.19.6 to 1.19.10 
Bumps [botocore](https://github.com/boto/botocore) from 1.19.6 to 1.19.10.
- [Release notes](https://github.com/boto/botocore/releases)
- [Changelog](https://github.com/boto/botocore/blob/develop/CHANGELOG.rst)
- [Commits](https://github.com/boto/botocore/compare/1.19.6...1.19.10)

Signed-off-by: dependabot[bot] <support@github.com>
 2020-11-03 02:23:18 +00:00
Jose Enrique Hernandez 101bc9ca05 Merge pull request #872 from splunk/dependabot/pip/pytz-2020.4 
Bump pytz from 2020.1 to 2020.4
 2020-11-02 21:22:20 -05:00
divious1 36f18aa2ca adding dependabot automerge with git workflows 2020-11-02 21:19:19 -05:00
dependabot[bot] 47b44bc4cb Bump pytz from 2020.1 to 2020.4 
Bumps [pytz](https://github.com/stub42/pytz) from 2020.1 to 2020.4.
- [Release notes](https://github.com/stub42/pytz/releases)
- [Commits](https://github.com/stub42/pytz/compare/release_2020.1...release_2020.4)

Signed-off-by: dependabot[bot] <support@github.com>
 2020-11-02 14:04:12 +00:00
P4T12ICK 86ff8d1878 Merge branch 'new_test_file_format' of github.com:splunk/security-content into new_test_file_format 2020-10-30 11:15:27 +01:00
P4T12ICK 94ee8537e4 improved testing 2020-10-30 11:13:48 +01:00
root e698682bdf Added detection testing service results inCreate local admin accounts using net exe 2020-10-30 10:13:19 +00:00
P4T12ICK c952f06956 new format for test files 2020-10-30 09:11:41 +01:00
Jose Enrique Hernandez eb268874bd Update kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml 2020-10-29 12:09:16 -04:00
P4T12ICK c02686fdad removed community api 2020-10-29 13:23:56 +01:00
Stanislav Miskovic 470c94fc90 Credential Extraction: Changing passing condition to a new syntax 2020-10-29 00:42:19 -07:00
Xiao Lin da26faa9d9 change input field names 2020-10-28 22:57:25 +00:00
Mikael Bjerkeland f9fa28dd18 Doc fix 2020-10-28 23:26:56 +01:00
Mikael Bjerkeland 17502e4722 Added various Network Infrastructure detections based on the MITRE Network Matrix 2020-10-28 23:14:06 +01:00
Ignacio Bermudez Corrales aa7266ffa3 added final report 2020-10-28 13:55:17 -07:00
Mikael Bjerkeland 7e068a5267 Added detection for T1020.001, Traffic Duplication 2020-10-28 21:51:33 +01:00
Xiao Lin 2c46a6d261 Merge branch 'develop' of github.com:splunk/security-content into TR162 2020-10-28 20:45:39 +00:00
Ignacio Bermudez Corrales f127325458 coverage by type SSA, ESCU 2020-10-28 13:45:11 -07:00
bpatel ce63b5b3c8 adding test file for suspicious_cloud_authentication_activities 2020-10-28 13:26:04 -07:00
Mikael Bjerkeland bb626c1466 . 2020-10-28 21:20:36 +01:00
Mikael Bjerkeland d5c6d72361 . 2020-10-28 21:14:40 +01:00
Mikael Bjerkeland eb9b85a381 Merge branch 'develop' of https://github.com/splunk/security-content into mbjerkeland-develop 2020-10-28 21:03:32 +01:00
Stanislav Miskovic b5707c8e22 Credential Extraction: moving test data from SMLE's to AR's S3 bucket and renaming test links 2020-10-28 11:38:08 -07:00
Ignacio Bermudez Corrales a715d3a193 script that shows the coverage for ssa detections 2020-10-28 09:08:13 -07:00
miskoSplunk 2839525e0c Update and rename credential_extraction_ms_debuggers_z_option.test.yml to ssa___credential_extraction_ms_debuggers_z_option.test.yml 2020-10-28 01:30:16 -07:00
miskoSplunk 67be9820f8 Update and rename credential_extraction_ms_debuggers_kernel_peek.test.yml to ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml 2020-10-28 01:29:01 -07:00
miskoSplunk f47a5e18af Update and rename credential_extraction_lazagne_command_options_ssa.test.yml to ssa___credential_extraction_lazagne_command_options.test.yml 2020-10-28 01:28:21 -07:00
miskoSplunk 2cdefdd198 Update and rename credential_extraction_fgdump_cachedump_v_option_ssa.test.yml to ssa___credential_extraction_fgdump_cachedump_v_option.test.yml 2020-10-28 01:27:38 -07:00
miskoSplunk 5f01133544 Update and rename credential_extraction_fgdump_cachedump_s_option_ssa.test.yml to ssa___credential_extraction_fgdump_cachedump_s_option.test.yml 2020-10-28 01:26:40 -07:00
Stanislav Miskovic afa732f7c4 Credential Extraction, renaming the rest of the files to ssa___ 2020-10-28 01:22:59 -07:00
Jose Enrique Hernandez 85c521c80a Merge pull request #847 from splunk/dependabot/add-v2-config-file 
Update Dependabot config file
 2020-10-27 19:29:15 -04:00
bpatel cad99d8dfb add risk scores 2020-10-27 16:19:50 -07:00
dependabot-preview[bot] 11b5336c21 Update Dependabot config file 2020-10-27 23:14:41 +00:00
Bhavin Patel dd69bd2d1b Merge pull request #844 from splunk/pretty-testing 
Improved logging of validate_ssa.py
 2020-10-27 16:07:52 -07:00
Ignacio f8f860bd5d Merge branch 'develop' into pretty-testing 2020-10-27 15:41:15 -07:00
Xiao Lin daea9d4192 change to use SSA input_event 2020-10-27 22:30:00 +00:00
Ignacio Bermudez Corrales b8e213cd2a added logging instead of printing 
argument controls logging info
 2020-10-27 15:30:00 -07:00
Xiao Lin 2ceba2da51 Merge branch 'develop' of github.com:splunk/security-content into TR162 2020-10-27 22:26:30 +00:00
miskoSplunk 3185517716 Update and rename credential_extraction_powersploit_modules_ssa.test.yml to ssa___credential_extraction_powersploit_modules.test.yml 2020-10-27 15:17:41 -07:00
miskoSplunk 575fd73422 Update and rename credential_extraction_mimikatz_modules_ssa.test.yml to ssa___credential_extraction_mimikatz_modules.test.yml 2020-10-27 15:16:05 -07:00
Rod Soto 625fe1c7bc fixnamedetection 2020-10-27 18:08:53 -04:00
Rod Soto be32b7bf01 detectuserencryptings3 2020-10-27 18:01:40 -04:00
Rod Soto a599d1ac21 modifiedmfasearch 2020-10-27 17:46:34 -04:00
Rod Soto 69e5aee23c detecionKMSkeyswMFA 2020-10-27 17:43:58 -04:00
Rod Soto 9d76d8e833 ransomware3story 2020-10-27 17:12:52 -04:00
dependabot-preview[bot] 7b61b36a5d Merge pull request #841 from splunk/dependabot/pip/boto3-1.16.6 2020-10-27 20:31:45 +00:00
dependabot-preview[bot] 3eedcfd10a Bump boto3 from 1.16.4 to 1.16.6 
Bumps [boto3](https://github.com/boto/boto3) from 1.16.4 to 1.16.6.
- [Release notes](https://github.com/boto/boto3/releases)
- [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst)
- [Commits](https://github.com/boto/boto3/compare/1.16.4...1.16.6)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-10-27 20:01:06 +00:00
dependabot-preview[bot] 8042ff1b5b Merge pull request #840 from splunk/dependabot/pip/botocore-1.19.6 2020-10-27 19:59:44 +00:00
dependabot-preview[bot] 9d79b215cd Bump botocore from 1.19.4 to 1.19.6 
Bumps [botocore](https://github.com/boto/botocore) from 1.19.4 to 1.19.6.
- [Release notes](https://github.com/boto/botocore/releases)
- [Changelog](https://github.com/boto/botocore/blob/develop/CHANGELOG.rst)
- [Commits](https://github.com/boto/botocore/compare/1.19.4...1.19.6)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-10-27 19:30:04 +00:00
miskoSplunk 8ec9c06f2e Update and rename credential_extraction_getaddbaccount_from_dump_ssa.test.yml to ssa___credential_extraction_getaddbaccount_from_dump.test.yml 2020-10-27 11:36:01 -07:00